Note that a path-restricted sandbox can block new directory creation

[dmccoystephenson]

Summary

Sharpens the existing "path-restricted sandbox" guidance in the generated-skill template with the stronger constraint observed in the last two gardener-dispatched cycles: the restriction is not only about reads outside the allowed root — creating a new directory can be blocked even inside the allowed working directory, which rules out "clone a fixture into a scratch subdirectory and run the anchor there" as a workaround.

Three prose edits, all inside the embedded template, all the same lesson:

• Phase 4, anchor-cannot-run paragraph — adds the new-directory clause and the explicit instruction to take the UNVERIFIED gate rather than engineering around the sandbox.
• Edge cases, "The external anchor cannot run" — same clause, condensed, so the edge-case entry and the phase text stay consistent.
• Phase 3, "Scratch-file handling in a sandboxed harness" — the sibling location for the same constraint: that bullet already told a skill how to delete a scratch directory tree, but not that creating one may be unavailable. Keep scratch work to individual files written into the existing tree.

No Step added, removed, or renumbered; no placeholder added or removed; no fenced block touched.

Test plan

• python3 scripts/check_docs.py — passes (every {{placeholder}} still has a Step 4 row; README "What it does" still 1:1 with the Steps; relative links resolve).
• Fence-escaping invariant intact — 36 escaped-fence lines (\``form) before and after; the diff touches no fence lines. (Note: the Phase 4 rubric's suggested grep uses a```` form that matches 0 lines in this file — a pre-existing wrong-form check already tracked as a skill-repo gap, not introduced here.)
• Read the full diff — 3 changed lines in 1 file, all within [self-audit] Session-sandbox restriction can block new directory creation, not just reads outside the allowed root #94's named surface area; no unrelated formatting or renames.
• Constraint re-confirmed live in this session: mkdir inside this checkout was refused by this dispatch's command layer, the same practical outcome [self-audit] Session-sandbox restriction can block new directory creation, not just reads outside the allowed root #94 documents from the PR Fix Phase 3 behavioral-claim verification and command-substitution rejection #93 cycle.
• UNVERIFIED — manual /create-dev-loop fixture regeneration not run. This PR changes template surface, so per CLAUDE.md's "Testing changes" the anchor is required. It cannot run here for exactly the reason this PR documents: this session cannot read ~/local-skills/ or create a scratch directory to generate a fixture into. Per the anchor-cannot-run gating (which this PR edits): template surface changed → do not auto-merge; handing to a human who can run /create-dev-loop against a real repo and confirm the five CLAUDE.md criteria.

RESEARCH.md grounding

No finding in RESEARCH.md covers harness sandbox/command-classifier behavior — this is an execution-environment constraint observed empirically across two consecutive live cycles (PR #93 and this one), not a claim from the cited literature. Stating that explicitly per CLAUDE.md's research-grounding rule. The change does reinforce §1/§5's premise that the self-review rubric is only meaningful when its external anchor is honest about whether it ran; no new citation or Implementations entry is warranted.

Backlog deferred this cycle

• [self-audit] create-dev-loop-dev-loop's configured self-audit tracker repo doesn't exist #87 (self-audit tracker repo create-dev-loop-dev-loop 404s) — a fix to the generated skill file itself, which lives outside this checkout and which Phase 9 forbids this loop from editing autonomously. Gap issues this cycle were filed to dmccoystephenson/cdl-dev-loop, which does exist.
• CLAUDE.md's documentation sources-of-truth table omits .github/ISSUE_TEMPLATE/*.md #81 (CLAUDE.md doc table omits .github/ISSUE_TEMPLATE/*.md) — requires editing CLAUDE.md, agent-loaded config that needs explicit human authorization.
• README and CLAUDE.md link gardener as an open-source companion, but the repo is private #79 (docs link gardener as open source while the repo is private) — needs a maintainer decision between "make gardener public" and "soften the docs", and option 2 also requires a CLAUDE.md edit.

Closes #94

---

This PR description was drafted during a Gardener session (Stephenson-Software/gardener).

[dmccoystephenson]

Self-review rubric (performed inline this cycle — this dispatch has no review subagent, and gh pr review / the reviews API are outside its allow-list, so the review is posted as a comment):

• Scope: PASS (with one judgment call) — git diff --numstat is 3 3 create-dev-loop.md; no formatting, renames, or comment churn. Judgment call: [self-audit] Session-sandbox restriction can block new directory creation, not just reads outside the allowed root #94 named the Phase 4 anchor paragraph and the Edge cases entry as candidate locations; I also touched a third, the Phase 3 "Scratch-file handling in a sandboxed harness" bullet. Rationale: that bullet already told a generated skill how to delete a scratch directory tree while never saying that creating one may be unavailable, so leaving it alone would have shipped the fix into two of the three places a skill actually looks. Reviewer may reasonably want it split out; it is one sentence.
• Tests-new: N/A — no script, function, or executable surface added; the change is prose inside the embedded template.
• Tests-fix: PARTIAL / not empirically stashed — [self-audit] Session-sandbox restriction can block new directory creation, not just reads outside the allowed root #94 is a completeness gap in instructions, not incorrect executable behavior, so the stash-and-run experiment has no runnable form here. What was confirmed empirically: mkdir inside this checkout was refused by this session's command layer, reproducing the constraint the new prose documents (the same failure PR Fix Phase 3 behavioral-claim verification and command-substitution rejection #93's cycle hit). Scoring this PASS from reasoning alone would be exactly the false-confidence the rubric exists to prevent, so it is recorded as PARTIAL.
• Sibling structure: N/A — no new file created.
• Sibling renames: PASS — no identifier renamed. The parallel-guidance sibling (the Edge cases entry mirroring the Phase 4 paragraph) was updated in the same commit, which is the rule's intent.
• Docs: PASS — Phase 7 table checked against the diff. create-dev-loop.md internally consistent (Phase 4 text and the Edge cases entry now say the same thing); README.md describes the external-signal anchor only in generic terms (line 65) and is unaffected; RESEARCH.md unchanged and no finding's confidence level is touched. SECURITY.md's trust-model reference to the Phase 4 anchor is likewise unaffected.
• Issue resolution: PASS — [self-audit] Session-sandbox restriction can block new directory creation, not just reads outside the allowed root #94's named surface area (the anchor-cannot-run paragraph and the matching Edge cases entry) is actually changed, and the clause it asked for is present verbatim in intent.
• External anchor (manual /create-dev-loop fixture regeneration): FAIL → UNVERIFIED — cannot run in this session for precisely the reason this PR documents. Template surface changed, so per the anchor-cannot-run gating this PR itself edits, this is not auto-merged; it needs a human who can run /create-dev-loop against a real repo and confirm the five CLAUDE.md "Testing changes" criteria. CI (doc-consistency) is green but does not substitute — it checks placeholder/Step/link invariants, not generation behavior.

Repo-specific items:

• Placeholder table completeness: PASS — python3 scripts/check_docs.py passes locally and in CI; no {{TOKEN}} added or removed.
• Fence escaping intact: PASS — 36 lines in the file open with the escaped fence form, unchanged; the diff touches no fence line. create-dev-loop.md:339 (rubric item as generated) — the escape-form check this rubric prescribes greps for \``` (one backslash, three backticks), which matches 0 lines in this file; the real form is a backslash before each backtick. Pre-existing wrong-form check, already tracked as a skill-repo gap (cdl-dev-loop#18); not introduced or worsened here, and not fixed here because it lives in the generated skill, not in this repo.
• README/Step 1:1: PASS — no Step added, removed, or renumbered; check_docs.py enforces this mechanically and is green.
• RESEARCH.md citation: PASS — the PR body explicitly states that no RESEARCH.md finding covers harness sandbox behavior, per CLAUDE.md's "honest 'we don't know' beats false confidence" rule, rather than stretching an unrelated finding to look grounded.

Verdict: mergeable content, blocked on the human-runnable anchor. One intrinsic-critique pass only; no re-run without a new external signal.